Acato vulnerabilities

Products

• WP REST Cache 3
• Branded Social Images 1
• Email Essentials 1

Latest Acato CVEs

Newest publication first

1. CVE-2026-116862 WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability

   Published 2026-10-30

   High·CVSS 7.5 EPSS 0.32%

   Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.

2. CVE-2026-81764 WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability

   Published 2026-08-31

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

3. CVE-2026-25347 WordPress WP REST Cache plugin <= 2026.1.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-03-25

   High·CVSS 7.1 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acato WP REST Cache wp-rest-cache allows Stored XSS.This issue affects WP REST Cache: from n/a through <= 2026.1.0.

4. CVE-2025-52716 WordPress WP REST Cache <= 2025.1.0 - Local File Inclusion Vulnerability

   Published 2025-08-14

   High·CVSS 7.5 EPSS 0.61%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acato WP REST Cache wp-rest-cache allows PHP Local File Inclusion.This issue affects WP REST Cache: from n/a through <= 2025.1.0.

5. CVE-2023-28536 WordPress Branded Social Images plugin <= 1.1.0 - Broken Access Control vulnerability

   Published 2024-12-09

   Medium·CVSS 5.3 EPSS 0.43%

   Missing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.